syzbot


KCSAN: data-race in __mod_timer / blk_add_timer (13)

Status: moderation: reported on 2025/12/05 11:05
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+b2cfdce5ab94c6187dc4@syzkaller.appspotmail.com
First crash: 2d01h, last: 2d01h
Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __mod_timer / blk_add_timer (6) block 6 1 978d 958d 0/29 auto-obsoleted due to no activity on 2023/05/09 08:21
upstream KCSAN: data-race in __mod_timer / blk_add_timer (10) block 6 1 319d 314d 0/29 auto-obsoleted due to no activity on 2025/03/19 05:59
upstream KCSAN: data-race in __mod_timer / blk_add_timer (11) block 6 3 221d 258d 0/29 auto-obsoleted due to no activity on 2025/06/24 14:35
upstream KCSAN: data-race in __mod_timer / blk_add_timer block 6 2 1661d 1695d 0/29 auto-closed as invalid on 2021/06/25 00:11
upstream KCSAN: data-race in __mod_timer / blk_add_timer (3) block 6 8 1436d 1534d 0/29 auto-closed as invalid on 2022/02/04 22:18
upstream KCSAN: data-race in __mod_timer / blk_add_timer (2) block 6 2 1586d 1616d 0/29 auto-closed as invalid on 2021/09/07 18:24
upstream KCSAN: data-race in __mod_timer / blk_add_timer (4) block 6 2 1344d 1362d 0/29 auto-closed as invalid on 2022/05/08 11:46
upstream KCSAN: data-race in __mod_timer / blk_add_timer (7) block 6 2 898d 914d 0/29 auto-obsoleted due to no activity on 2023/07/28 08:54
upstream KCSAN: data-race in __mod_timer / blk_add_timer (5) block 6 1 1199d 1199d 0/29 auto-closed as invalid on 2022/09/29 13:43
upstream KCSAN: data-race in __mod_timer / blk_add_timer (12) block 6 4 63d 133d 0/29 auto-obsoleted due to no activity on 2025/11/29 15:07
upstream KCSAN: data-race in __mod_timer / blk_add_timer (9) block 6 1 540d 540d 0/29 auto-obsoleted due to no activity on 2024/07/19 18:23
upstream KCSAN: data-race in __mod_timer / blk_add_timer (8) block 6 7 690d 728d 0/29 auto-obsoleted due to no activity on 2024/02/20 17:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __mod_timer / blk_add_timer

write to 0xffff888101760920 of 8 bytes by task 9042 on cpu 0:
 __mod_timer+0x5a1/0x840 kernel/time/timer.c:1126
 mod_timer+0x1f/0x30 kernel/time/timer.c:1195
 blk_add_timer+0x182/0x1a0 block/blk-timeout.c:164
 blk_mq_start_request+0x183/0x3d0 block/blk-mq.c:1374
 loop_queue_rq+0x43/0x680 drivers/block/loop.c:1860
 __blk_mq_issue_directly block/blk-mq.c:2714 [inline]
 blk_mq_request_issue_directly+0x1e9/0x380 block/blk-mq.c:2801
 blk_mq_issue_direct+0x19d/0x530 block/blk-mq.c:2822
 blk_mq_dispatch_queue_requests+0x1fc/0x350 block/blk-mq.c:2897
 blk_mq_flush_plug_list+0x2b6/0x330 block/blk-mq.c:2980
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1225
 blk_finish_plug block/blk-core.c:1252 [inline]
 __submit_bio+0x2fc/0x4d0 block/blk-core.c:651
 __submit_bio_noacct_mq block/blk-core.c:724 [inline]
 submit_bio_noacct_nocheck+0x152/0x5c0 block/blk-core.c:755
 submit_bio_noacct+0x746/0x9a0 block/blk-core.c:879
 submit_bio+0x2a6/0x2c0 block/blk-core.c:921
 submit_bh_wbc+0x2e0/0x320 fs/buffer.c:2824
 submit_bh fs/buffer.c:2829 [inline]
 __bread_slow fs/buffer.c:1272 [inline]
 __bread_gfp+0x15c/0x240 fs/buffer.c:1518
 sb_bread include/linux/buffer_head.h:346 [inline]
 isofs_fill_super+0x417/0x12b0 fs/isofs/inode.c:632
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1699
 get_tree_bdev+0x1f/0x30 fs/super.c:1722
 isofs_get_tree+0x1c/0x30 fs/isofs/inode.c:1538
 vfs_get_tree+0x57/0x1d0 fs/super.c:1759
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x24d/0x6a0 fs/namespace.c:3712
 path_mount+0x4ab/0xb80 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888101760920 of 8 bytes by task 3665 on cpu 1:
 blk_add_timer+0x115/0x1a0 block/blk-timeout.c:-1
 blk_mq_start_request+0x183/0x3d0 block/blk-mq.c:1374
 loop_queue_rq+0x43/0x680 drivers/block/loop.c:1860
 __blk_mq_issue_directly block/blk-mq.c:2714 [inline]
 blk_mq_request_issue_directly+0x1e9/0x380 block/blk-mq.c:2801
 blk_mq_issue_direct+0x19d/0x530 block/blk-mq.c:2822
 blk_mq_dispatch_queue_requests+0x1fc/0x350 block/blk-mq.c:2897
 blk_mq_flush_plug_list+0x2b6/0x330 block/blk-mq.c:2980
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1225
 blk_finish_plug+0x48/0x70 block/blk-core.c:1252
 read_pages+0x401/0x480 mm/readahead.c:176
 page_cache_ra_unbounded+0x34e/0x450 mm/readahead.c:302
 do_page_cache_ra mm/readahead.c:332 [inline]
 force_page_cache_ra mm/readahead.c:361 [inline]
 page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579
 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2683
 filemap_read+0x231/0xa00 mm/filemap.c:2793
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:860
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x64c/0x770 fs/read_write.c:572
 ksys_read+0xda/0x1a0 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:722
 x64_sys_call+0x2889/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffffb9d3 -> 0x00000000ffffbdbd

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3665 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/05 11:04 upstream 2061f18ad76e d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __mod_timer / blk_add_timer
* Struck through repros no longer work on HEAD.